libre.sh/keycloak-scim
2
0
Fork 0
Code Issues 14 Pull requests Releases Packages Activity Actions 6

Remove effective roles filtering to avoid inconsistency (#28099)

Browse source 
* Changed effective roles filtering method

Signed-off-by: Andreas Blaettlinger <bln1imb@bosch.com>

* Adjusted remaining endpoints

Signed-off-by: Andreas Blaettlinger <bln1imb@bosch.com>

---------

Signed-off-by: Andreas Blaettlinger <bln1imb@bosch.com>
This commit is contained in:
Andreas Blättlinger 2024-07-08 14:56:55 +02:00 committed by GitHub
parent a918eb1e30
commit f4178bfa26
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/EffectiveRoleMappingResource.java
View file

@ -60,7 +60,7 @@ public class EffectiveRoleMappingResource extends RoleMappingResource {
this.auth.clients().requireView(clientScope); this.auth.clients().requireView(clientScope);
return toSortedClientRoles( return toSortedClientRoles(
addSubClientRoles(clientScope.getScopeMappingsStream()) addSubClientRoles(clientScope.getScopeMappingsStream())
.filter(auth.roles()::canMapClientScope)); );
} }
@GET @GET
@ -90,7 +90,7 @@ public class EffectiveRoleMappingResource extends RoleMappingResource {
auth.clients().requireView(client); auth.clients().requireView(client);
return toSortedClientRoles( return toSortedClientRoles(
addSubClientRoles(client.getScopeMappingsStream()) addSubClientRoles(client.getScopeMappingsStream())
.filter(auth.roles()::canMapRole)); );
} }
@GET @GET
@ -120,7 +120,7 @@ public class EffectiveRoleMappingResource extends RoleMappingResource {
auth.groups().requireView(group); auth.groups().requireView(group);
return toSortedClientRoles( return toSortedClientRoles(
addSubClientRoles(addParents(group).flatMap(GroupModel::getRoleMappingsStream)) addSubClientRoles(addParents(group).flatMap(GroupModel::getRoleMappingsStream))
.filter(auth.roles()::canMapRole)); );
} }
@GET @GET
@ -154,7 +154,7 @@ public class EffectiveRoleMappingResource extends RoleMappingResource {
user.getGroupsStream() user.getGroupsStream()
.flatMap(g -> addParents(g)) .flatMap(g -> addParents(g))
.flatMap(GroupModel::getRoleMappingsStream))) .flatMap(GroupModel::getRoleMappingsStream)))
.filter(auth.roles()::canMapRole)); );
} }
@GET @GET
@ -179,9 +179,7 @@ public class EffectiveRoleMappingResource extends RoleMappingResource {
auth.roles().requireList(realm); auth.roles().requireList(realm);
final RoleModel defaultRole = this.realm.getDefaultRole(); final RoleModel defaultRole = this.realm.getDefaultRole();
//this definitely does not return what the descriptions says //this definitely does not return what the descriptions says
return toSortedClientRoles( return toSortedClientRoles(addSubClientRoles(Stream.of(defaultRole)));
addSubClientRoles(Stream.of(defaultRole))
.filter(auth.roles()::canMapRole));
} }
private Stream<RoleModel> addSubClientRoles(Stream<RoleModel> roles) { private Stream<RoleModel> addSubClientRoles(Stream<RoleModel> roles) {